End users are a lightweight user type for people who consume MCP tools through AI clients (Claude, Cursor, and other MCP-compatible clients) but don't need access to integrator.io. They authenticate to MCP servers, not to the Celigo platform; they can't build integrations, manage flows, or view the integrator.io dashboard.
This is a new user type and access model, not an extension of an existing one, end users are managed entirely separately from the workspace users you already invite to integrator.io. This article covers the full lifecycle: inviting end users, understanding their status, granting and reviewing their access, and disabling or removing them.
Tip (Manual invite or SSO with JIT?): Manual invitations work well for small teams, dev and test setups, internal pilots, and anyone whose email domain isn't tied to a configured external IdP. For production rollouts backed by an enterprise IdP (Okta, Microsoft Entra ID, or Auth0), configure that IdP with JIT provisioning instead, end users are created automatically on first sign-in, so you won't need to invite people one by one. Group membership still needs to be assigned in Celigo. Group sync (the IdP automatically keeping Celigo group membership in sync) only works with identity providers that send group names in the token, which excludes Okta, Entra ID, and Auth0 as configured out of the box.
Prerequisites
- You need the administrator access level on your account.
- Your account must be multi-environment. End users aren't available on legacy sandbox-only accounts.
- To grant MCP access during the invite, at least one end-user group must exist with MCP server mappings configured.
End users vs. workspace users
End users and workspace users are separate user types with different purposes.
| Workspace users | End users | |
|---|---|---|
| Purpose | Build integrations, manage flows, monitor errors, administer accounts | Consume MCP tools via AI clients |
| integrator.io access | Yes | No, blocked from signing in |
| Access model | AShare with access level (monitor, manage, administrator) | End-user groups and direct MCP server assignments |
| Authentication | Account SSO or Celigo credentials | End-user authentication (configured separately from account SSO) or Celigo credentials |
The same person can be both a workspace user and an end user in the same account, an engineer who builds integrations and also uses MCP tools, for example. That creates two records, but only one email, one password, and one MFA enrollment: what differs between the two records is what each one's sign-in grants access to, not the underlying credentials.
Invite end users
You can invite one or more end users at once, the invite form takes a batch of emails.
- Go to Account (the avatar at the top right of the page), and then select Users.
- Go to End users → Users.
- In the End users view, click + Invite end users.
If you already invited a few users and wish to invite more, then click + Invite end users at the upper right side of the page.
-
Enter the required fields:
- Emails: Enter one or more email addresses, comma-separated. Each email is evaluated independently: if its domain matches a configured IdP, that person is activated immediately through SSO with no setup email; if it doesn't match any IdP, they get a setup email to create a Celigo password. If an address already belongs to a verified Celigo identity, it's activated silently instead, no email is sent.
-
Groups (optional): Select one or more groups to add these end users to. This grants MCP access as soon as each end user's account is active, without a second step. You can also manage group membership later from End users → Groups.
- Click Invite.
End users don't set their name during the invite, they enter it themselves as part of account setup (or, for end users who sign in through an IdP, their name comes from the IdP on first sign-in). Invitations expire after 7 days, and there's no resend button. If a link expires, the end user sees "Invite link has expired. Contact your admin for a new invite." There is no way to resend it as is. The recovery path is to remove the end user and invite them again (inviting an address that already has an active end-user record is rejected as a conflict). One exception: if the person's email domain matches an IdP with JIT provisioning enabled, simply signing in repairs a stale invitation without needing a new one. If you're inviting a large group ahead of a rollout, time the invitations against your rollout communications so the 7-day window doesn't lapse.
View end users details
Go to End users → Users to view and manage the end users in your account. The End users page displays the following information:
| Column | Description |
|---|---|
| Name | The end user's name. Click the name to view or manage the user's details. |
| The end user's email address. | |
| Status | The user's current account status. You can filter the list by status. |
| Groups | The groups the end user belongs to. You can filter the list by group. |
| Last sign in | The date and time of the user's most recent authentication. |
| Enable user | Enables or disables the end user directly from the list. When disabled, the user can't authenticate to MCP servers. You can re-enable them later. |
| Actions |
Provides actions such as Manage user and Remove user from environment. To permanently remove an end user:
Removing an end user deletes their record and all group memberships. This can't be undone. |
Use the Search box to find users by name or email. You can also use the Status and Groups filters to narrow the list.
To configure authentication settings, select Authentication settings. This opens Account → Security → End users → Authentication, where you can manage Celigo credentials, multi-factor authentication (MFA), and external identity providers.
End user statuses
Each end user has a status visible in the End users → Users list.
| Status | Meaning |
|---|---|
| Invited | Invited but hasn't finished account setup (hasn't set a password yet). Applies only to end users on Celigo credentials. |
| Active | Set their password, or sign in through a configured external IdP. Can now authenticate to MCP servers. |
| Disabled | Disabled by an admin. Can't authenticate to any MCP server. |
Assign an MCP server to an end user
Beyond group-based access, you can grant an individual end user direct access to a specific MCP server.
- Go to End users → Users and open an end user or click (...) in the Actions column and select Manage user.
- In the MCPs tab, click + Assign MCPs.
-
You can:
- Select the MCP server checkbox to include all current and future capabilities. If you select specific capabilities instead, new capabilities added later aren't included automatically.
- Click to open an MCP server and select one or more required capabilities.
- Click Save.
Direct access works alongside group-based; the end user's effective access is the union of all group memberships and direct assignments. See Create and manage end-user groups for how effective access is calculated.
Migrate existing workspace users
If your account has workspace users with per-server MCP access from before Celigo Identity shipped, that access can be migrated to end-user records so it's managed the same way as everything else in this article. Migration runs as an internal process rather than through a page in the product, each migrated user gets a new end-user record with direct access to the same servers and capabilities they had before (not placement in a matching group), and their workspace-user access to integrator.io is untouched. If you have workspace users you think should be migrated, talk to your Celigo contact, this isn't currently a self-service admin action.